What actually happens inside an electronic money institution

An electronic money institution is authorised to issue and redeem electronic money and to provide the payment services attached to it. In France that authorisation comes from the ACPR, which then supervises the institution continuously. What you receive is less a certificate than the opening of a relationship, one in which you are periodically asked to demonstrate that what you described in your application is still what you do.

That single fact reorganises engineering priorities. Anything you claimed in the application is now a system requirement with an audience.

Everything else in the institution is support for these four.

A loop that does not close leaves a gap, and gaps are cumulative. Ninety unexplained daily differences of a few euros are not a small problem multiplied by ninety. They are one large problem: the institution cannot demonstrate coverage, which is the core prudential obligation.

An electronic money institution holds initial capital and must maintain ongoing own funds calculated, for the electronic money activity, as a percentage of the average outstanding electronic money. The percentage is small. The word doing the work is "average".

Average outstanding electronic money is a rolling measure over a period, which means it depends on a daily series that must exist, be correct, and be reproducible. Teams that compute outstanding electronic money monthly for reporting discover that the prudential requirement needs it daily, historically, and consistently with the figure used for safeguarding.

Compute it once, daily, store it, and let every consumer read the stored series. The alternative is three systems computing the same regulatory number three ways, which is a finding waiting to be written.

The distinction that separates institutions with calm audits from institutions with painful ones is where evidence comes from. In the painful version, a control exists as a procedure someone follows, and evidence is gathered afterwards by asking that person for screenshots. In the calm version, the control is code, and running it writes a record: the rule version, the population it examined, the exceptions raised, the disposition of each, the identity of the reviewer, and the time.

The second version costs more to build and almost nothing to sustain. The first costs nothing to build and consumes a person permanently, then fails at the worst moment because the person was on holiday in March.

The test is simple. Pick a control. Ask what it did on a specific date eight months ago. If answering requires a human to remember, the control is not evidenced.

Shipping continuously is normal engineering practice and it is compatible with supervision, but only if the record of change is as good as the record of operation. A regulated institution has to be able to say which version of which rule was in force when a given transaction was processed, and to show that the change was reviewed by someone with the authority to approve it.

That means rules carry versions and effective dates, and historical processing is explained by the version that was in force rather than the version in production today. Retroactively reprocessing history under current rules destroys the audit trail even when it produces prettier numbers.

Supervision is interested in the separation between the people who run the business and the people who control it, and in whether the control function can actually see what it needs to see without asking permission from the function it controls.

In practice that is an access design problem. Compliance and internal audit need read access to operating data by right, not by request, and that access must itself be logged. Building it early is a week of work. Retrofitting it after an inspection is a project.

The licence describes a set of properties the system has to keep having while everything else changes around it. Nobody ever finishes it.

Engineering that accepts this early builds fewer things twice. The daily series exists once. The control produces its own evidence. The rule carries its version. None of that is exotic. It is simply decided at the right time, which is before the first user.